Microsoft BitLocker Administration and Monitoring (MBAM) provides a simplified administrative interface that you can use to manage BitLocker drive encryption. You can also report on the encryption status of an individual computer and on the entire enterprise. As part of the prerequisites, you must define certain roles and accounts that are used in MBAM to provide security and access rights to specific servers and features, such as the databases that are running on the instance of SQL Server and the web applications that are running on the Administration and Monitoring Server.
Kindly refer to the following guide: How to fix you are not allowed to view this folder on SSRS, how to correctly disable Microsoft BitLocker Administration and Monitoring encrypted devices, how to hide the Default BitLocker Drive Encryption item in the Windows Control Panel, how to check if Microsoft BitLocker Administration and Monitoring (MBAM) is installed on Windows and Unable to install Microsoft Bitlocker Administration: Uninstall your current version of MBAM and run setup again.
Note: Once the installation of Microsoft BitLocker Administration and Monitoring (MBAM) concludes for all server features, administrative users should receive access to these features. For optimal practice, assign administrators to Active Directory security groups. Then, add these groups to the relevant MBAM administrative local group. This ensures efficient management of MBAM server features.
Users and Groups created in Active Directory to support MBAM installation
We established the subsequent groups and users within Active Directory. Users do not have to have greater user rights. A domain user account is sufficient. You’ll have to specify the name of these groups during the configuration of MBAM 2.5. Below are the created service accounts and security groups. Service Accounts (users) do not need to have greater user rights.
Once the Microsoft BitLocker Administration and Monitoring (MBAM) Setup concludes, all server features are ready. Now, we can grant access to these features for administrative users. For optimal practice, administrators handling Microsoft BitLocker Administration and Monitoring Server features ought to join Domain Services security groups. Next, ensure inclusion of these groups in the appropriate MBAM administrative local group. This approach surpasses directly adding users to SSRS Users/Groups for MBAM report administration, as depicted in the image.
You are free to use any name of your choice. The image above and the table below illustrate my usage of descriptive names for clear identification within my Lab environment. You are free to use the name you like or as documented in the Microsoft guide.
Example of Description Names to use within Lab Environment
| Name | SA/ SG | Description |
| MBAM-RO-SVC | User Account | Read-only service account: Domain user group whose members have read-only access to the reports in the Reports area of the Administration and Monitoring Website |
| MBAM-RW-SVC | User Account | Read/write service account |
| MBAM-IISAP-SVC | User Account | IIS application pool service account: Domain user account to be used by the application pool for the web applications. The same account also used to Configure Databases page. |
| MBAM Helpdesk Users | Security Group | Members of this group are granted read-only access to the helpdesk portal |
| MBAM Advanced Helpdesk Users | Security Group | Members of this group are provided with helpdesk access without the need to specify user and computer details for recovery |
| MBAM Report Users | Security Group | Members of this group have access to the MBAM SSRS reports |
| MBAM Database Read-Only | Security Group | Security Group for adding Read-Only DB members |
| MBAM Database Read-Write | Security Group | Security Group for adding Read-Write DB members |
The image below illustrates how we added these accounts and groups to the MBAM (SQL) Server, supporting MBAM deployment. In the post-installation of SQL Server, make sure that you provide the user accounts in SQL Server. You can allocate permissions to users or groups responsible for setting up MBAM database and reporting roles on the server. These same prerequisites also apply to the compliance and audit database.
To manage MBAM Administrator Role memberships
These roles are vital for the installation of MBAM features and the post-installation of MBAM features as well. Kindly refer to this link on how these roles were used in the installation of the MBAM MBAM/features. On the Administration and Monitoring Server, add users to the following local groups to give them access to the MBAM Help Desk website features:
- MBAM Helpdesk Users: Members of this local group can access the Drive Recovery and Manage TPM features on the MBAM Administration and Monitoring website. A Helpdesk User must complete all fields in Drive Recovery and Manage TPM as they are all mandatory.
- MBAM Advanced Helpdesk Users: Members of this local group have advanced access to the Drive Recovery and Manage TPM features on the MBAM Administration and Monitoring website. Advanced Helpdesk Users need to fill only the Key ID field in Drive Recovery. For Manage TPM, only the “Computer Domain” and “Computer Name” fields are obligatory.
On the Administration and Monitoring Server, add users to the following local group to enable them to access the Reports feature on the MBAM Administration and Monitoring website:
- MBAM Report Users: Members of this local group can access the Reports features on the MBAM Administration and Monitoring website. The image below illustrates how the installation of MBAM reports utilizes this group.
I hope you found this blog post on Microsoft BitLocker Administration and Monitoring Roles helpful. If you have any questions, please let me know in the comment session.